What is a botnet, and how does it relate to DDoS attacks?

A botnet is a network of malware-infected machines under one operator's control — often used to launch DDoS attacks.

* Botnet to DDoS — an operator drives infected hosts (including IoT) through C2 to flood a victim and knock out its availability. *

After infection, computers (bots) are linked together and their resources/data used by the operator, usually without the owners' knowledge. The operator sends commands over a control channel (historically IRC).

Connection to DoS/DDoS:

• A DoS (Denial-of-Service) attack targets availability — overwhelming a service so legitimate users can't reach it.
• A DDoS (Distributed DoS) runs the attack from many systems at once — exactly what a botnet provides. Small agent programs on each bot are coordinated centrally via "handlers."

Why botnets are scary: they turn ordinary, poorly-secured devices (including IoT) into a rentable attack army — for DDoS, spam, or credential stuffing.

Tip: This is why your own device's hygiene matters to others — an infected machine becomes a weapon aimed at someone else.

Go deeper:

• Botnet (Wikipedia) — the C2 architecture, IoT bots and DDoS use.
• Denial-of-service attack (Wikipedia) — how distributed flooding exhausts a target's resources.
• Mirai (Wikipedia) — the canonical IoT-botnet case study — the Dyn and Krebs record DDoS attacks.